The One, The Only, The Vulnerable Vista

Lets start this out by saying that Vista was designed to be more secure, and it appears to be headed in the right direction there. Just don't get me started on DRM.

Once again Vista, the impenetrable, that is according to the marketing hype has been proven vulnerable. There was the ANI vulnerability that MS rushed a patch out for last week, and now during the regular update there is a second vulnerability designated as critical by MS for Vista.

Once the all the hype is removed it is just another operating system by Microsoft that has it's flaws. Once is has had time to mature I'll consider adding it to one of my systems. For now I'll only "play" with it as a virtual machine.

Vista Smista & ANI Exploit

OK, I've gotten it out of my system. I'm not a fan of Vista I have two main issues in regards to Vista:

1. The fact that Digital Rights Management (DRM) has some control over my system, and can degrade or disable viewing "premium content" when someone else feels that there is a potential for me to steal premium content. I'd call that guilty unless proven innocent.
2. Then there is the marketing, I shouldn't call it scam, hype that Vista in invulnerable.

Issue 1 has been beaten to death by many people including myself.

For issue 2 I'll mention Microsoft Security Advisory (935423). This was commonly referred to as the Microsoft ANI vulnerability, and Vista was one of the version that was vulnerable.

ANI Details

In short this was disclosed to Microsoft in December of 2006. Apparently the first report of this vulnerability was used as an exploit was March 28th. Due to the wide spread use of the exploit several third parties released interim patches, including my favorite Zeroday Emergency Response Team (ZERT). Microsoft reacted, as it tends to do when third party patches are released, and the news media starts to publish... Microsoft released the official patch out-of-cycle on Tuesday the 3rd of April (instead of today the 10th of April)

The Register on Vista Security

The Register has a good blow-by-blow article on Vista Security (http://www.theregister.co.uk/2007/02/20/vista_security_oversold/). As you would hope for it covers the good, the bad and the ugly. This is true despite an inflammatory remark, especial if taken out of context as it is here:

In a nutshell, Windows is single-handedly responsible for turning the internet into the toxic shithole of malware that it is today.

I explains IE7s sandbox techniques and then shows,what I will term bugs, where it violates the sandboxed environment.

There is of course the touted User Account Control (UAC) which is a good concept... gone bad.

The quote below gives a good description:

And there's the catch: "Windows needs your permission to install this cleverly-disguised Trojan nifty program. Click Yes to get rooted continue."

I have more details in a previous post near the end "The ultimate Vista malware is... Setup.exe" (http://sec-soapbox.blogspot.com/2007/02/6-million-dollar-os-or-new-prey-in-town.html)

Then there is "Data hygiene:"

Finally, it's fixed.

Oh wait; it's not fixed. In fact, things just got a lot worse.

...

The worst part of this is that by offering the option to disable the list of recent files, MS has given users a false sense of privacy and security. The reality is that privacy and data hygiene are even more difficult than before. What a blunder.

The summary of the summary

So, what have we got here... We have got... a slightly more secure version than XP SP2... good features... good ideas... implemented badly.

The 6 Million Dollar OS: Or A New Prey in Town

I can just hear it "We can re-build it better, faster, more secure... the 6 million dollar OS"

Is it really better or just a new meal for the predators of the Internet

Microsoft Vista is a rewrite of the desktop version of Microsoft's flagship Windows OS. It is touted as the most secure, stable, advanced OS yet. What is the reality behind the hype?

Anecdotally:

• No major company is even interested in it
• XP is a more stable platform for multimedia
• XP is a more stable platform for First Person Shooter (FPS) games

Factual:

• Where the rubber hits the road for the Information Superhighway: This is the main interface to the outside world where web pages, e-mail and IM (http://en.wikipedia.org/wiki/Instant_message) flow between computers. As with all of Vista this was re-written from scratch to be more secure, but instead of learning from the past history was repeated. Flaws that had been fixed in XP appeared in the new code which doesn't bode well. In Security the old "tried and true" adage is accurate (nothing is perfect and over time flaws will surface and be, hopefully, fixed). The SecurityNow "Vista's Virgin Stack" podcast(http://grc.com/securitynow.htm) has additional information

• Microsoft challenges the hackers: Microsoft touted the security of Vista and dared hackers at the last Defcon conference to breach their security. So security researcher Joanna Rutkowska showed a room full of attendies how to install a Vista rootkit (http://www.technewsworld.com/story/52254.html).

• The ultimate Vista malware is... Setup.exe: Joanna Rutkowsa has found a bigger hole in the User Account Control (UAC) design (http://blogs.zdnet.com/security/?p=29&tag=nl.e589). When a setup program is detected you have two choices give it administrative rights, or don't install it. This is a complete violation of the Principle of least privilege. A game should not have rights to install a rootkit err... I mean a kernel driver. According to Microsoft's Mark Russinovich's blog (http://blogs.technet.com/markrussinovich/archive/2007/02/12/638372.aspx) "...potential avenues of attack, regardless of ease or scope, are not security bugs." Excuse me.